Malware detection systems often employ virtual environments to enable potentially malicious objects to be safely analyzed during run-time in one or more sandboxed virtual machines. Each virtual machine is provisioned with a guest image, where the guest image is configured in accordance with a particular software profile. This particular software profile is dependent on the type of object being analyzed. For example, where the object is an accessed web page, the software profile may prescribe a browser application that runs over a specific operating system (e.g., Windows®, Linux®, etc.). As another example, where the object is an electronic message, the software profile may prescribe an email application running over the same or a different operating system (e.g., Microsoft® Mobile®, Blackberry® OS, etc.).
For processing a suspicious object, the virtual machine is provisioned with a guest image that features software components for the prescribed software profile. Typically, during virtual processing, the suspicious object may cause a software application associated with the guest image to initiate a system call that requests a service from the guest operating system (OS). The service may include a hardware-related service (e.g., accessing a hard disk drive, etc.). According to certain conventional security architectures, all system calls are intercepted by a virtual machine monitor (VMM), which is operating in kernel mode. Thereafter, the parameters associated with the system call are subsequently passed to virtual machine memory inspection logic (VMMI), which monitors behaviors (e.g., activities and/or omissions) conducted by virtualized device hardware in the processing of an instruction pertaining to the system call. Stated differently, the VMM passes control of the virtual processing to the VMMI, which is operating in user mode.
This conventional system call monitoring process features a few disadvantages. One disadvantage is that the amount of processing time required for conducting a context switch in passing parameters associated with the system call (from the VMM operating in the kernel mode to the VMMI operating in the user mode) is substantial which may impact performance of the malware detection system.